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Abstract 

A semi-blind watermarking scheme is presented based on Singular Value Decom¬ 
position (SVD), which makes essential use of the fact that, the SVD subspace 
preserves significant amount of information of an image and is a one way de¬ 
composition. The principal components are used, along with the corresponding 
singular vectors of the watermark image to watermark the target image. For 
further security, the senri-blind scheme is extended to an invisible hash based 
watermarking scheme. The hash based scheme commits a watermark with a key 
such that, it is incoherent with the actual watermark, and can only be extracted 
using the key. Its security is analyzed in the random oracle model and shown 
to be unforgeable, invisible and satisfying the property of non-repudiation. 

Keywords: Singular Value Decomposition (SVD), Principal Components, 

Semi Blind Watermark, Invisible Watermark, Hash Code 


1. Introduction 

The advent of the internet has made it possible to easily store and share digi¬ 
tal information and multimedia. While this has largely benefited all, protection 
of digital multimedia content has become an increasingly important issue for 
content owners and service providers. A common and well-proposed solution to 
this problem is the Digital Watermark. It is an important tool for copyright pro¬ 
tection that embeds data into multimedia content, which can be later detected 
or extracted. Because of its key role in security and establishing ownership in 
multimedia hies, watermarking is an area of active interest among a wide spec¬ 
trum of researchers. In the last two decades considerable amount of research 
has been devoted to study various methods for efficiently watermarking images, 
which are both practically viable and theoretically sound. 
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Taking advantage of the optimal image decomposition property of Singu¬ 
lar Value Decomposition for embedding a watermark in an image, several SVD 
based watermarking schemes have been proposed. Singular Value Decomposi¬ 
tion is a general linear algebraic technique, whereby a given matrix (image in 
this case), is diagonalized such that most of the signal energy is localized in a 
few singular values, (Golub and Reinsch, 1970). A digital image A of size M x 
N can be represented by its SVD as 


A = USV T , 


where U and V are orthogonal matrices of size M x M and N x N, re¬ 
spectively. S' is a diagonal matrix of size M x N , with the diagonal elements 
representing the singular values (SVs). Columns of matrix U , also known as left 
singular vectors, are the eigenvectors of AA T , while columns of matrix V (right 
singular vectors) are eigenvectors of A T A. It is worth noting that, the singular 
vectors of an image specify the image geometry, while the singular values specify 
the luminance (energy) of the image. 

For an image of size M x N (let M > N , without any loss of generality), 
the singular vectors have 0(N 2 ) elements, as compared to just O(N) diagonal 
elements in the singular value matrix. Hence, this makes the use of singular 
vectors for information hiding more appropriate than using the singular values, 


as used by Chang et al. (20051 and also by Agarwal and Santhanam (2008). 


It is due to the elegant properties of SVD, that it has gained much atten¬ 


tion, and has been studied rigorously. Lei et al. (20141 used a hybrid technique 


i.e., using wavelet transform and SVD followed by a recursive dither modula¬ 
tion algorithm, to insert signature information and textual data into the cover 
medical images. In addition, differential evolution was also applied to design 
the quantization steps optimally for controlling the strength of the watermark. 


Calagna et al. (2006) divided the cover image into blocks and applied SVD to 


each block; the watermark was then embedded in all the non-zero singular val¬ 
ues according to the local features of the cover image. Bergman and Davidson 
(2005) used SVD as a medium to embed information and give steganography 


scheme. Also Profrock et al. (2008) proposed a SVD based watermarking and 


steganography schemes where watermarking scheme was designed by slightly 
modifying the most significant singular values for encoding vital data in the 
media. Lai (2011) presented a SVD-based watermarking technique considering 
human visual characteristics through block selection with Discrete Cosine Trans¬ 


formation (DCT) followed by SVD. Quan and Qingsong (2004) also used DCT 
and SVD to construct a watermarking scheme. Zhou and Jin (2011) proposed a 


zero-watermarking scheme combining Discrete Wavelet Transform (DWT) and 
SVD. The features are extracted from the cover image by applying DWT and the 
SVD to each non-overlapping block. The embedding of zero watermarking was 
realized through the exclusive or (XOR) between singular value of each block 
and the pixel value of the actual binary character watermark sequentially. [Tsai 
et al. (2012) gave a blind scheme based on DWT and is based on SVD and Sup¬ 
port Vector Regression. Here, the embedding algorithm hides a watermark bit 
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in the low-low (LL) sub-band of the cover image’s principal components of the 
block. Additionally Particle Swarm Optimization has been utilized to optimize 
the scheme. Also, Ray et al. (2015) proposed a DWT-SVD based scheme, and 
additionally encrypting and embedding the SVD with RSA algorithm. |Pandey| 
et al. (20141 recently presented a non-blind, adaptive watermarking scheme, 


based on DWT and SVD, where they used principle components and percep¬ 
tual tuning. Khorrami et al. (2014) used a family of chaotic maps and SVD. To 
encrypt the watermark logo and to improve the security of watermark image 
Jacobian elliptic map were used, along with Quantum maps to determine the 
location of image’s block for the watermark embedding. Yet another commonly 


used method for watermarking is through Image Segmentation (Arora et al. 


20081, as studied by Boulgouris et al. (2002), Profrock et al. (2008), Gaata 


et al. (2011). For an in-depth review of Digital Watermarking and Multimedia 


encryption, the reader is referred to Cox et al. (2002), Furht et al. (2006), Cox 


et al. (2007). 


In this paper, we first present a SVD Based Semi-Blind watermarking scheme, 
whose efficacy and security depends on the fact that the SVD subspace preserves 
significant amount of information of an image and that SVD is a one way decom¬ 
position. The Semi-blind watermarking schemes (or semi-private watermarking 
schemes), do not require the cover image to detect the watermark. To intro¬ 
duce the watermark the principal components and the singular values of the 
watermark image are embedded in the cover (original) image, and the detector 
only needs a complimentary set for watermark extraction from the embedded 
watermark image. 

Subsequently an Invisible Hash Based Watermarking Scheme is derived from 
the Semi-Blind Scheme. The invisible watermarking schemes, unlike visible 
ones, commit to a key, with embedding the watermark image in the cover (orig¬ 
inal) image, which remains incoherent with the real watermark image. The 
watermark can be extracted only when the original key is available. The secu¬ 
rity of the proposed invisible hash based watermarking scheme is analyzed in 
the random oracle model and shown to be unforgeable, invisible and satisfying 
the property of non-repudiation. 

The paper is organized as follows. The Semi-Blind Watermarking Scheme 
is presented and demonstrably shown to be efficient in Section 2. In Section 3, 
a construction a hash code based Invisible watermarking scheme is given, and 
is proved to be secure in the random oracle model. Finally the practicality of 
the proposed schemes for multichannel (color) images are examined in section 
4, followed by conclusion. 


2. Semi-Blind Watermarking Scheme 

In consideration of the fact that the singular vectors U and V have majority 
of image information, and SVD is a one way decomposition, we propose a scheme 
whereby the principal components of watermark image are embedded into the 
singular values of original image. Using this scheme, only a set of singular 
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vectors are required to be known at the detector. The security of this emerged 
from the fact that SVD is a one way decomposition. 

Using SVD, a matrix, A, representing a mono-channel image can be repre¬ 
sented as 


A = USV T , (1) 

W => U w S w Vj => A wa Vj, (2) 

where A is the original (mono-channel) image and W is the watermark to be 
embedded in A. A wa = U w are also known as principal components. Embedding 
the principal components, A wa , with a corresponding diagonal singular value 
matrix S of the original image, we get Si and the corresponding watermarked 
image A w . 

Si = S + aA wa , (3) 

USiV T => A w , (4) 

Let A*, denote the possibly distorted watermarked image at the detector. 
To recover back the watermark image W* from A* w , following are the steps 
involved, 


(A* w -A)=>Ai, (5) 

{U- 1 A 1 (V T )- 1 )/a=>A^ oa , (6) 

K,aVj => w*, (7) 

We now try to search for a reference image, e.g., Plane, in the image water¬ 
marked with baboon using our scheme. We first find the SVD of the original 
plane image P as, 


P => U p S p Vj , 

To find a possibly distorted plane image in the distorted watermarked image 
A*, 0 , the singular vectors of reference image are used as follows, 

P* => A* wa V p T : (8) 

Since, one of the singular vectors of watermark is embedded in the original 
image; watermark extraction without knowing the original principal components 
is not possible. This clearly shows that, no reference image can be extracted 
from any arbitrary image using the proposed scheme [Fig.Id]. 
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Figure 1: (a) Original Lena image (b) Original Baboon image (c) Original Plane 
image (d) Watermarked image, baboon embedded in Lena image (e) Watermark 
extracted from (d) using the proposed scheme (f) Distorted reference image 
Plane extracted from (d) 


3. A Hash Code based Invisible Watermarking Scheme 

Following the semi-blind watermarking scheme described in the preceding 
section, we give an invisible watermarking scheme derived from the same. An 
invisible watermarking scheme essentially contains a ’’scrambled” watermark 
encoded in the original image that can be made visible only with a key. Ideally, 
an invisible watermarking scheme should have the following properties: 

Un-forgeability: No adversary should be able to forge a watermark with 
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an key, id', that the owner (of the original image) has not watermarked, 
such that, 

Pr[A(A w ,id!) = {A! w ,id')\ = negligible 

Non-repudiation: Once a signer (owner of the original image) has signed 
or watermarked an image with some key id, the signer cannot repudiate 
the associate id, such that, 

Pr[A(A w , id) = (A w ,id')\ = negligible 

Invisibility: The watermarked image, without the knowledge of the key, 
id it was watermarked with, should be indistinguishable from an image 
containing a watermark of white noise from an uniform distribution, such 
that, 

Pr[D(A w ) = 1] — Pr[D(Au ) = 1] = negligible 

where, A and T> are polynomial time adversaries and distinguishers re¬ 
spectively. A w is an image watermarked with key, id, Ajj is an image con¬ 
taining a watermark of white noise from an uniform distribution, id' 7 ^ id 
and A. w 7 - A w . 

The key idea we used here, is to commit a M x N dimensional watermark 
image W to a unique id (e.g. derived from the customer’s name). The id, for 
security reasons, must have some random nonce in it. 

To do so, we use a collision resistant cryptographic hash function with poly¬ 
nomial span, H, for generating an integer string ft e {0,..., 255}-^*^ <— H(id), 
and then convert ft to a M x N matrix hid, using a row-major format. In¬ 
formally, our hash function (of polynomial span) is defined as H : {0,1}* —» 
{0,..., 255} M * N , such that the following properties hold: 

1. It is computationally hard to find a pre-image, i.e., given y = H(x), to 
compute x. 

2. It is computationally hard to find a collision, i.e., given H{x), to compute 
x' such that H(x') = H(x) 

3. It is indistinguishable from a random number, i.e., given H{x) and y <r- 
{0 ,..., 255}l ff ^, hard to distinguish w.p. > 1/2 

Finally a element-wise XOR of the matrix A wa , as in eq. 11 and hid to 
obtain the A wa is performed. 

Formally, given original image A, a watermark W, and a identity id, we 
introduce a watermark to the image by first decomposing 

A = USV T , 

W = U w S w Vj = A wa vj, 

Subsequently, we encode the watermark on to the image as 

Si = S + a(A wa ® e hid ) (9) 
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Here a is the scaling factor, and ® e is the element-wise XOR, defined as 

A ® e B = A itj ® 


US 1 V T = A w , (10) 

After executing the above computations, we get A w which contains a unique 
watermark embedded in A. 

To extract and verify the invisible watermark, from the image A w , we essen¬ 
tially make use of the unique id (used earlier to introduce the watermark), and 


to extract the watermark W from A w as, 

A W -A = A 1 , (11) 

(U~ 1 AiV t ~ 1 )/a = (A wa ® e h id ), (12) 

( A wa ® e Hid ) ®e hid — A wa , (13) 

A wa Vj = W, (14) 


3.1. Security Analysis 

THEOREM: If if is a collision resistant secure hash function and the 
Semi-Blind watermarking scheme (from section 2) is secure, then the Hash Code 
Watermarking Scheme is secure. 

LEMMA 1 : If if is a collision resistant secure hash function and the Semi- 
Blind watermarking scheme (from section 2) is secure, then the Hash Code 
Watermarking Scheme is unforgeable. 

Proof Sketch: (by contradiction) Suppose 3 adversary , A which can forge a 
watermark to produce A' w using some id' that the owner did not watermark. 
Then we can either use A as a subroutine of B that finds a collision such that 
H(id) = H(id') or we can use A as a subroutine of C that can find a pre-image 
of the hash function. 

It is straight forward to construct B. B queries ftgpoiy©) 1° the hash oracle 
7f, that returns if (ft). B simply uses ft as key, to watermark different images 
and give them to A. If A can produce an key id ft, such that H(id) = H{qi) 
for some i, then B simply returns the H(id),id' to win the game. 

One can construct the pre-image finding game as follows: C queries qi^ po i y (n) 
to the hash oracle P, that returns if (ft). C simply hash codes all watermarks 
with id = qi and gives them to A. Finally when A returns a different id' ^ {ft}vi 
and possibly different A w forgery C computes 
A! w -A = A i; U~ X A X V T ~ X = A wa © H(id') 

Following that, C computes A wa © H(id') ffi A wa = H(id') and returns 
( H(id'), id') to the hash oracle to win the game. 
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However, since we assumed our hash function is pre-image resistant, this is 
a contradiction. □ 

LEMMA 2: If H is a collision resistant secure hash function and the Semi- 
Blind watermarking scheme (from section 2) is secure, then the Hash Code 
Watermarking Scheme has the property of non-repudiation. 

Proof Sketch: (by contradiction) Suppose 3 adversary, A which can repudi¬ 
ate a watermark A w signed by some key id with a different key id 1 , then we can 
use A as a subroutine of B to find a collision in the hash function. 

The construction is straightforward (as in Lemma 1) where B queries the 
hash oracle {li}i^ po iy(n) to obtain H(q i ),\/i. B watermarks all images with 
id = qi and gives them to A. If A can successfully return any pair (id, id '), 
such that H(id) = H(id'), B returns the (id, id') to the hash oracle to win the 
collision finding game. 

However, since we assumed our hash function is collision resistant, this is a 
contradiction. □ 

LEMMA 3: If I? is a collision resistant secure hash function and the Semi- 
Blind watermarking scheme (from section 2) is secure, then the Hash Code 
Watermarking Scheme is invisible. 

Proof Sketch: (by contradiction) Suppose 3Distinguisher , V which can dis¬ 
tinguish a watermark A w from Ajj (Ajj is an image contain a watermark of 
white noise from an uniform distribution) in polynomial time, then we can use 
T> as a subroutine of B to win the distinguishability game. 

We construct the distinguishability game as follows: B queries qi € poly(n) 
to the hash oracle TL, that returns H{qi). B then hash codes all watermark 
with id = qi and gives them to V. Finally as challenge, the hash oracles gives 
(H(id),U r -H- {0,..., 255} M * Ar ) to B. B then creates two watermarks A^ 

and Aw with H{id) and U r respectively and gives it to V. V can distinguish 
the image containing the real watermark with probability more thanl/2, and 
returns the correct watermark Aw to B. B can simply return the hashed string 
corresponding to A$ to the hash oracle to win the game. 

However, since we assumed the output of our hash function is indistinguish¬ 
able from a random sequence, this is a contradiction. □ 

Proof of Theorem: From Lemma 1, Lemma 2 and Lemma 3, we can assert 
that the hash code watermarking scheme is secure for any arbitrary image. ■ 

4. Extension to Color Images 

In the previous sections, we described two constructions that introduces 
a watermark or fingerprint to a greyscale digital images, which are M x N 
matrices. This construction can be easily extended to support color images 
with M x N x 3 as well. One common used approach is marking only the 



luminance component of the the image, where the greyscale leveling techniques 
described in the previous sections is straightforward to apply. 

The luminance component of a 3- dimensional matrix with R, G, B channels 
is computed as 


L = M + m 

where, M = max(R , G, B) and m = mi^R, G , B) 


(15) 


Yet another technique, put forward by Kutter et al. (1997) proposes em¬ 
bedding the watermark on the blue channel, since the human eye is sensitive to 
this band. Also another straightforward technique is to watermark each channel 
individually. This can be naturally used to watermark either mono-channel or 
multichannel images on multichannel cover images. 


5. Conclusion 

We have presented two watermarking schemes based on SVD - a Semi- 
Blind Watermarking Scheme and an Invisible Hash Code based Watermarking 
Scheme. The security of the first scheme relies on the fact that the information 
about the entire watermark is not available without a prior knowledge of the 
original watermark and also the principal components along with their singular 
values are embedded in the watermark. These two ideas help avoid common 
pitfalls for the case of the semi-blind watermarking scheme. A construction of 
new Invisible Hash Code Based Watermarking Scheme derived from the pro¬ 
posed Semi-Blind Watermarking Scheme has also been proposed here, whose 
security is proved in the random oracle model and shown to be unforgeable, 
invisible and satisfying the property of non-repudiation. Lastly, straightforward 
extensions of the aforementioned schemes for multichannel (color) images are 
discussed. Given SVD is a one way decomposition, and based on the construc¬ 
tions and security proofs described in the paper, we conclude that our methods 
help ensure rightful ownership of the digitally watermarked image. 
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